Unless the insurer writes under five hundred million dollars a year of direct premium plus premium assumed from non-affiliates (counting international business, leaving out federal crop and flood reinsurance) and, if in a group, the group has under one billion dollars, the insurer or group must set up an internal audit function giving the audit committee and management independent, objective, reasonable assurance over governance, risk management and controls, by auditing, reviewing and testing so as to safeguard assets, judge whether controls work and are efficient, and check compliance with policies and rules. The function must be independent within the organisation: the final call on audit matters is its own, and its head can go straight to the board without restriction. The head reports to the audit committee regularly, at least once a year, on the audit plan, on anything threatening the function's independence or effectiveness, on material findings and the adequacy of management's corrective actions. The requirement may be met at the ultimate parent, an intermediate holding company or the legal entity level.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.